• DPI Home
• |
• Site Map

Introduction

Scope & Deliverables

This PIA was conducted on behalf of DPI in order to ascertain the overall state of consumer privacy protection within the AMI program, in parallel with the broader program reviews being undertaken by the new state government. The contracted PIA was required to deliver the following:

1. Project description: Broadly describe the project, including the aims and whether any personal information will be handled.
2. Mapping the information flows and privacy framework: Describe and map the project’s personal information flows and document all relevant legislative and organisational rules.
3. Privacy impact analysis: Identify and analyse the project’s privacy impact.
4. Privacy management: Consider how to manage any privacy impact, particularly options that will improve privacy outcomes and still achieve the project’s goals.
5. Recommendations: Produce a final PIA report covering the above stages and including recommendations

This report is structured accordingly.

This PIA is not a detailed assessment of the privacy compliance of any particular organisation involved in smart metering. It may be the case that electricity distributors and retailers will undertake separate PIAs of their respective businesses, in the same way as they undertake their own security evaluations. Moreover, our investigation of privacy and security practices at various participants was limited to relatively short interviews, to attain a general understanding of how RBs and DBs work with customer data across the board. We have had to generalise to a significant extent about security and customer service practices. We have tried to make clear in this report where we make assumptions and where such assumptions should be substantiated by further investigation.

The PIA was focused on the difference to privacy made by introducing smart metering. We do not seek to pass judgement on the privacy arrangements for customer data collected from older “accumulation” (“spinning disk”) meters, nor to any other data handled by businesses.

The PIA does attempt to anticipate (as best we can at this stage) privacy issues arising in the medium term, when Home Area Networks (HANs) come to be activated, and when power consumption data may start to be shared with third parties which are not currently Licensed Participants.

Methodology

This PIA was conducted primarily by means of desk top review of business analysis and technical documents and in-person interviews with selected stakeholders.

In summary, the desk top review covered:

• AMI project documentation
• NSMP project documentation
• Customer communications of the DBs and RBs
• ZigBee technical specifications
• ESC regulations and codes
• the National Electricity Rules (particularly chapter 7)
• selected stakeholder submissions to AMI program reviews.

The full list of documents in the desk-top review appears in the References section.

Stakeholder meetings

We conducted two waves of focused stakeholder meetings as detailed in the table below, in order to understand the AMI program from all angles, and to collaboratively explore and uncover privacy issues. The first wave of meetings (June 21-22) was with individuals for the most part selected by DPI to give us a fast start to the investigation stage, including consumer groups and advocates. We met informally¹ with members of the Energy Networks Association (ENA) and the Electricity Retailers Association of Australia (ERAA) to discuss broad industry issues. During the first visit we were also able to make a few additional ad hoc appointments. The second wave (July 11-12) was an attempt to engage with a fuller and more representative set of industry stakeholders.

¹ These meetings were “informal” in the sense that they were not conducted on the basis of anyone claiming to represent the official views of the respective associations. Rather, individuals were senior players in the industry and could be relied upon as authoritative insofar as they are deeply informed by the perspectives of retail and distribution business.

On July 27 we convened a three hour workshop in Melbourne with a wide range of stakeholders, to present interim findings and to discuss the ramifications of our initial recommendations. Attendees were as follows:

Terms of reference

The primary terms of reference for this PIA are the National Privacy Principles (NPPs), based on the fact that in Victoria all DBs and nearly all RBs are large privately owned enterprises. There are two types of exception to this rule.

Firstly, it is possible that the very smallest electricity retailers fall below the annual revenue limit that defines small-to-medium enterprises (namely $3M p.a.) which are exempt from the Privacy Act. While it is expected that any viable RB would generate revenues in excess of $3M eventually, it may be prudent during the early stages of such a business to clarify that it is expected to comply with the NPPs. One way to ensure this is for small retailers to expressly opt in to be bound by the NPPs, as can be done at http://www.privacy.gov.au/business/small/opting

Secondly, the ownership of one RBDnamely Red EnergyDmay be traced back to state governments via Snowy Hydro Limited. This means that Red Energy is neither a private business nor a federal government agency, and thus it falls outside the jurisdiction of federal privacy legislation. Nevertheless, we note that both Red Energy and Snowy Hydro have committed themselves to the NPPs:

We occasionally make additional reference to the Victorian Charter of Human Rights & Responsibilities, for it includes obligations with respect to individual privacy. Technically, the Charter only applies to the government of Victoria and not to private industry, yet because smart meters are mandated by government, there is an argument that the Charter may be relevant. We also note that the Victorian Privacy Commissioner made mention of the Charter in her submission to the ESC review [8] when she highlighted that people are concerned about smart metering representing a sort of intrusion into their homes. If the Charter does not hold sway formally, it still acts as a useful benchmark.

The Victorian Human Rights Commission notes that:

That is, as an arm of government, DPI may need to refer to the Charter when developing policies in the AMI program, even though electricity market participants themselves are not themselves bound by it.

DPI should take heed also of the statement that "the Victorian Ombudsman can receive and investigate complaints about whether administrative actions taken by the Government, local councils and public authorities are in breach of, or have not properly considered human rights".